OC
Product
october
On CISA KEVExploited in the wild
62
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 15Medium 36Low 4
Watch
Add october to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-61674 | 4.8 | Jan 10 | October CMS Vulnerable to Stored XSS via Editor and Branding Styles Affected: >= 4.0.0, < 4.0.12; < 3.7.13 |
| CVE-2025-61676 | 4.8 | Jan 10 | October CMS Vulnerable to Stored XSS via Branding Styles Affected: >= 4.0.0, < 4.0.12; < 3.7.13 |
| CVE-2024-24764 | 4.8 | Jun 26 | October Open Redirect for Administrator Accounts Affected: >= 3.2, < 3.5.15 |
| CVE-2020-11083 | 4.8 | Jul 14 | In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against… Affected: 1.0.319 before 1.0.466 |
| CVE-2020-5298 | 4.8 | Jun 3 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController`… Affected: 1.0.319 before 1.0.466 |
| CVE-2024-45962 | 4.7 | Oct 2 | October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system Affected: 3.6.30 |
| CVE-2020-15248 | 4.2 | Nov 23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework Affected: 1.0.319 before 1.0.469 |
| CVE-2026-49400 | 3.3 | Sep 14 | October CMS: PHP Object Injection via Backend Widget Session Storage Affected: < 3.7.17; >= 4.0.0, < 4.2.23 |
| CVE-2026-29179 | 3.3 | Apr 21 | October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations Affected: >= 4.0.0, < 4.1.16; < 3.7.16 |
| CVE-2026-27937 | 3.1 | Apr 21 | October: Reflected XSS via DataTable Form Widget Affected: >= 4.0.0, < 4.1.16; < 3.7.16 |
| CVE-2020-5297 | 2.7 | Jun 3 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif,… Affected: 1.0.319 before 1.0.466 |
| CVE-2015-5612 | – | Sep 4 | Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image Affected: All versions, or not specified |